Red Hat Security AdvisoryRHSA-2025:3453
Red Hat JBoss Core Services Apache HTTP Server 2.4.62 security update
Released 2025-04-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Core Services 2.4.62
Fixes 10 records
Priority MEDIUM 54
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.05582 · Published 2024-06-27 · Partial fix · 3.3.2, 3.2.3 +4 CWE-125
Priority MEDIUM 52
An issue was discovered in libexpat before 2.6.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01686 · Published 2024-08-30 · Partial fix CWE-190
Priority MEDIUM 46
libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04296 · Published 2024-07-24 · Fixed
Priority MEDIUM 45
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01178 · Published 2025-02-18 · Partial fix · 2.12.10, 2.13.6 CWE-416
Priority MEDIUM 43
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02149 · Published 2024-02-04 · Partial fix CWE-400
Priority LOW 37
xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.
CVSS 3.1HIGH 8.1· Local · No auth · No interaction · EPSS 0.00265 · Published 2025-01-26 · Partial fix · 2.11.0 CWE-416
Priority LOW 36
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c.
CVSS 3.1HIGH 7.8· Local · No auth · No interaction · EPSS 0.00385 · Published 2025-02-18 · Partial fix · 2.12.10, 2.13.6 CWE-121
Priority LOW 33
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.02874 · Published 2024-04-04 · Partial fix CWE-113
Priority LOW 28
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.01715 · Published 2024-07-01 · Fixed CWE-476
Priority LOW 25
A vulnerability was found in mod_proxy_cluster.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00381 · Published 2025-04-23 · Partial fix · 1.3.21.Final, 1.3.21-1.el10 +4 CWE-863
THREATIST.IORead the docs